shimo-rbac

usage

  const rbac = new RBAC(roles, options);

  // 访问路由时检查权限
  // allow: result = null
  // deny: result = [deny reason]
  const result = rbac.check({
    roles: 'admin'  // roleId or array of roleId,
    target: 'get /admin', // route
  });

  // 更新数据时检查权限
  // allow: result = null
  // deny: result = [deny reason]
  const result = rbac.check({
    roles: 'admin'  // roleId or array of roleId,
    target: 'team', // model name
    source: {       // data to update
      balance: 999,
    }
  });

roles

• name {String}
• merge {Enum: force | merge} 多个 role 如何合并权限, force 独占, merge 合并
• weight {Number} 合并权限时的权重
• desc {String}

name	merge	weight
admin	force	1
banned	force	2
free	merge	999999
vip	merge	10
alpha	merge	0

permissions

• target {String}
• action {Enum: deny(0) | read(1) | write(2) | readwrite(3)}

role	target	action
admin	team.balance	3
guest	get /	1
guest	get /desktop	0
free	get /desktop	1
free	get /vip_feature	0
vip	get /vip_feature	1
alpha	get /alpha_feature	1

列表中的权限默认为禁止 普通用户 free 付费用户 free vip 合并 禁止用户